CVE-2026-22812 - OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution - Full Analysis

CVE ID : CVE-2026-22812 Published : Jan. 12, 2026, 11:15 p.m. | 1 hour, 35 minutes ago Description : OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in 1.0.216. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor